IIA-CRMA Certification Questions in Risk Management Assurance (CRMA) Exam

1. Allegations have been made that an organization’s share price has been manipulated.

Which of the following would provide an internal auditor with the most objective evidence in this case?

2. Which of the following is not a standard technique that the chief audit executive (CAE) would use to provide evidence of supervisory review of working papers?

3. Which of the following best ensures an internal audit activity has the ability to render impartial and unbiased assessments?

4. According to the Standards, for how long should internal auditors who have previously performed or had management responsibility for an operation wait to become involved in future internal audit activity with that same operation?

5. According to IIA guidance, which of the following is the best example of a system application control?

6. Which of the following would not be a red flag for fraud?

7. After being terminated due to downsizing, an internal auditor finds a different job with an organization in the same industry.

Which of the following actions would violate the IIA Code of Ethics?

8. Which of the following best describes the assessment of risks?

9. An organization has implemented a new automated payroll system that contains a table of pay rates that are matched to employee job classifications.

Which control should an internal auditor suggest in order to ensure that the table is updated correctly, and is used only for valid pay changes?

10. According to the Standards, which of the following is not a consideration when exercising due professional care for an assurance engagement?

11. According to IIA guidance, which of the following statements is true?

12. Which of the following is not an appropriate activity for internal auditors to perform?

13. While reviewing first quarter sales transactions, an internal auditor discovered that 10 invoices for a new customer had not been posted into the accounts receivable subsidiary ledger. Those 10 invoices were listed in an error report automatically generated by the sales processing system. The system had rejected the invoices because the customer’s account number was not found in the customer master file.

In this scenario, which of the following controls was lacking?

14. A candidate has applied for an entry level internal audit position. The candidate holds a CISA (Certified Information Systems Auditor) designation, and has six months of audit experience, but limited knowledge of accounting principles and techniques.

According to the IIA guidance, which of the following is the most relevant reason for the chief audit executive to consider this candidate?

15. Which of the following actions indicates a lack of due professional care by an internal auditor performing an audit of a store’s cash function?

16. Which type of objectives can best be described as broad goals that promote the effective and efficient use of resources?

17. The last quality assessment of the internal audit activity identified three areas for improvement: the achievement of audit engagement objectives, quality of work, and staff development.

According to IIA guidance, which of the following should be the chief audit executive’s primary focus to achieve these recommended improvements?

18. According to the Standards, which of the following best describes why initial audit test results should be reported to the auditor-in-charge prior to advising management?

19. The internal audit supervisor is reviewing the workpapers prepared by the staff.

According to the Standards, which of the following statements regarding workpaper supervision is not true?

20. An internal audit charter describes the mission and scope of the internal audit activity (IAA), responsibilities of the IAA, accountability of the chief audit executive, independence of the IAA, and standards followed by the IAA.

Which of the following also should be included in the charter?

21. They can rely on evidence taken from the work of other assurance activities across the organization.

22. According to IIA guidance, which of the following individuals would best be considered independent for the purpose of participating in an external assessment of the quality assurance and improvement program for an internal audit activity (IAA)?

23. In which of the following scenarios would a customer service hotline receive a high volume of complaints regarding payments not being applied to customers’ accounts?

24. A manufacturing organization discovers that the waste water released has failed to meet permitted limits.

Which control function will be least effective in correcting the issue?

25. During an internal audit, the internal auditor compares the employee turnover rate in the area being audited with the employee turnover rate in the organization as a whole.

This is an example of which of the following analytical auditing procedures?

26. Which of the following actions does not violate the IIA Code of Ethics or Standards?

27. A chief audit executive (CAE) of an international charity reports functionally to the audit committee of the board of directors and administratively to the charity’s chief financial officer (CFO).

Which of the following would impair the internal audit function’s independence?

28. Leave blank space for cross-references to be completed during the post-audit process.

29. This chief audit executive (CAE) engaged an internal auditor to consult on an organization’s complex information technology system. Shortly after beginning the engagement, the auditor unexpectedly resigned. Unfortunately, this auditor was the only available auditor with the necessary expertise. The CAE will not be able to hire someone with similar expertise in time to meet a regulatory deadline.

Which of the following would be the best course of action for the CAE to take?

30. Which of the following is not one of the 10 core competencies identified in the IIA Competency Framework?

31. The director of purchasing, a certified internal auditor (CIA), signs a contract to procure a large order from a supplier whose products provide the best price, quality, and performance. A few days after signing the contract, the supplier presents the CIA with $1, 000 as a gift.

Which statement regarding acceptance of the money is correct?

32. According to IIA guidance, which of the following objectives of an assurance engagement for the organization’s risk management process is valid?

33. Justified and necessary, according to the IIA Code of Ethics and Standards.

34. A computer system automatically locks a user’s account after three unsuccessful attempts to log on.

Which type of control does this scenario represent?

35. If an engagement client disputes that a specific action or process is within the scope of the internal audit activity, what would be the most appropriate way for the internal audit activity (IAA) to respond?

36. During an internal audit, an organization’s processing department is found to have incidences of both duplicate invoices and notices from customers that purchased goods were not received. The department under review insists that some of these reports are false and that others were isolated oversights due to understaffing.

Which of the following tests would best help the internal auditor detect fraudulent activity?

37. Which of the following does not need to be defined in the internal audit charter?

38. Cost of the engagement versus the potential benefits.

39. Suspecting fraud, the chief financial officer (CFO) asked the internal audit activity to investigate a significant increase in travel related expenditures. Work was performed by a qualified internal auditor. Following the completion of the engagement, the chief audit executive (CAE) reported to the CFO that no violations were found and no fraud had occurred.

According to the Standards, which of the following principles did the CAE violate?

40. According to IIA guidance, which of the following best describes processes and tools typically used in ongoing internal assessments?

41. An internal auditor would like to identify the involvement of various organizational units in handling employee travel reimbursement claims.

Which of the following methods would be most effective and efficient in completing this task?

42. Which of the following would provide the best evidence of errors in the quantities of items received from suppliers?

43. Management of a publicly-held organization requires the internal audit activity to be involved with quarterly financial statements, which are made public and used internally.

Which of the following explanations of management’s decision is least plausible?

44. Which of the following is a second line of defense in effective risk management and control?

45. An internal auditor makes a series of observations when performing an analytical review of division operations. The auditor notes the following things: the current ratio is increasing and the quick ratio is decreasing, sales and current liabilities have remained constant, and the number of day sales in inventory is increasing.

Which conclusion should the auditor draw from this data?

46. A staff auditor, nearly finished with an audit engagement, discovers that the director of marketing has a gambling habit. The gambling issue is not directly related to the existing engagement, and there is pressure to complete the current engagement. The auditor notes the problem and forwards the information to the chief audit executive, but performs no further follow-up.

Which of the following statements is true about the auditor’s actions?

47. Which of the following scenarios would represent the greatest threat to the authority of the internal audit activity (IAA)?

48. Which of the following controls is not appropriate for sales in a manufacturing organization?

49. Maintain open and effective communications with the audit committee.

50. A new chief audit executive (CAE) of a large internal audit activity (IAA) is dissatisfied with the current amount and quality of training being provided to the staff and wishes to implement improvements.

According to IIA guidance, which of the following actions would best help the CAE reach this objective?

51. Which of the following is a preventive control?

52. Which of the following would most likely be considered a red flag for fraud?

53. According to the IIA guidance, who is responsible for periodically assessing the internal audit activity?

54. Which of the following scenarios exemplifies a potential internal control weakness?

55. An internal auditor notes that employees are able to download files from the internet.

According to IIA guidance, which of the following strategies would best protect the organization from the risk of copyright infringement and licensing violations resulting from this practice?

56. According to IIA guidance, which of the following statements regarding the internal audit charter is true?

57. Which of the following is an example of a transaction-level control?

58. Why is a code of ethics for the internal audit profession necessary?

59. Management has asked the chief audit executive (CAE) to provide assurance on the organization’s automated control system related to financial data. The current audit staff does not have the expertise needed to conduct this type of engagement.

Which of the following would be the best response by the CAE?

60. During an account receivables audit, an internal auditor found a significant number of input errors resulting in a $500, 000 balance understatement.

Which of the following is the most important question the internal auditor should ask to develop an appropriate recommendation for this finding?

61. Which of the following is not a role of the internal audit activity in facilitating risk identification and evaluation?

62. An internal auditor for a large retail chain suspects that a store manager has been stealing money from cash sales by listing the sales as accounts receivable and then writing off the accounts as bad debts.

Which of the following irregularities is the most likely cause of the auditor’s suspicion?

63. The chief audit executive (CAE) of a mid-sized pharmaceutical organization has operational responsibility for the regulatory compliance function. The audit committee requests an assessment of regulatory compliance.

According to IIA guidance, which of the following is the CAE’s best course of action?

64. Which of the following techniques would best assist an internal auditor in evaluating the efficiency of a wholesale grocery distributor`s process to fill and package orders for shipping?

65. During an engagement, an internal auditor decided to use variance analysis as an auditing techniques.

Which of the following steps should the auditor pursue if he discovers unexpected deviations of actual results from budget?

66. The results of an internal audit activity’s (IAA) quality assurance and improvement program are favorable and an external assessment was completed within the last five years.

Which of the following statements may the IAA use to describe its work?

67. Which of the following risk management activities is most appropriate for an internal auditor to undertake?

68. An internal auditor finds during an engagement that payment for the organization’s general insurance policy is two months overdue. The issue is informally mentioned to the finance department which immediately submits the invoice for payment. The auditor decides to

exclude this finding from the final audit report as the oversight was immediately corrected and there were no consequences because of this late payment.

Which of the following rules of conduct as described in the IIA Code of Ethics, did the auditor fail to uphold?

69. While reviewing the workpapers of a new auditor, the auditor in charge discovered that additional audit procedures might be necessary.

According to IIA guidance, which of the following would be most relevant for the auditor in charge to consider when making this decision?

70. Which of the following audit procedures would provide the most relevant information to identify discrepancies between budgeted versus actual raw material consumption in a production facility?

71. An internal auditor is reviewing employee travel data to identify opportunities to cut costs while ensuring adequate participation at conferences to support the organization’s mission.

Which of the following pieces of evidence would be sufficient for completing this task?

72. Why is it important for the chief audit executive to periodically review the audit charter and present the results to senior management and the board?

73. While attending a conference, an internal auditor won an all-expense paid trip sponsored

by a vendor of the internal auditor’s organization.

Which of the following actions are most appropriate for the auditor to take?

74. The audit committee is concerned that the small size of the internal audit activity (IAA) makes it impractical to achieve full conformance with the Standards.

To address this concern, which of the following actions is most appropriate for the CAE to take?

75. End user security is inadvertently granted to an unauthorized individual by management.

76. Which of the following would be considered a preventive control?

77. Control activities.

78. Which of the following statements is true regarding the use of non-statistical sampling in auditing control tests?

79. Which of the following would provide the best guidance to a chief audit executive who is setting internal audit staff requirements?

80. When conducting an interview, an internal auditor is most likely to ask open-ended questions in order to:

81. Which of the following conditions is the most likely indicator of fraud?

82. A government agency’s policy states that board members’ travel and hospitality expenses must be audited annually.

Which of following people or groups is most appropriate to perform this audit?

83. Perform assurance procedures with sufficient care to ensure that all risks are identified.

84. Which of the following activities best reflects the scope and status of the internal audit activity as defined in the internal audit policy statement?

85. An internal audit activity (IAA) provided assurance services for an activity it was responsible for during the preceding year.

As a result, which IIA Code of Ethics principle is presumed to be impaired?

86. Which of the following is the most effective strategy to manage the risk of foreign exchange losses due to sales to foreign customers?

87. Visual observations can assist an auditor in determining if a material observation should be communicated through informal means to the organization’s senior management.

88. Why are preventative controls generally preferred to detective controls?

89. To identify potential efficiency improvements.

90. An internal audit manager of a furniture manufacturing organization is planning an audit of the procurement process for kiln-dried wood. The procurement department maintains six procurement officers to manage 24 different suppliers used by the organization.

Which of the following controls would best mitigate the risk of employees receiving kickbacks from suppliers?

91. What is the primary purpose of a fishbone diagram?

92. An organization’s chief audit executive (CAE) determines that the internal audit staff does not have the requisite skills to conduct an audit of the financial derivatives area.

Which of the following would be the best course of action for the CAE to follow?

93. Which of the following is the most significant disadvantage of using checklists to evaluate internal controls?

94. According to IIA guidance, which of the following statements is false regarding continuing professional education for the internal audit activity (IAA)?

95. Which of the following decisions made during the testing phase of a compliance audit requires the most judgment by an internal auditor?

96. What type of risk management strategy is being employed when an organization installs two firewalls to provide protection from unauthorized access to the network?

97. A chief audit executive (CAE) learns that the brother-in-law of a senior auditor who audits the procurement process was hired as the head of the procurement department six months prior.

Which of the following is the most appropriate action for the CAE to take?

98. Which of the following audit techniques is used to evaluate control design while also embodying auditing’s analytical process?

99. The chief audit executive (CAE) has been asked to manage the regulatory compliance function for the organization’s retail store operations. Store operations are included in the annual audit plan.

Which of the following strategies best fulfills the requirements of the Standards regarding these audits?

100. An accounts receivable clerk receives cash payments, posts the payments to customer accounts, and prepares the daily cash deposit.

The clerk has been stealing some cash and manipulating the customer payments to hide the theft.

This fraud could be detected with which of the following controls?